add 0030/SESSION-0030.0-TRANSCRIPT-2026-05-28T16-12--2026-05-28T17-39.md + replace placeholder/variant SESSION-0030.0-TRANSCRIPT-2026-05-28T16-12--INPROGRESS.md
This commit is contained in:
Ben Stull
@@ -0,0 +1,211 @@
|
||||
# Session 0030.0 — Transcript
|
||||
|
||||
> Date: 2026-05-28
|
||||
> Start: 2026-05-28T16-12 (PST implied)
|
||||
> End: 2026-05-28T17-39 (PST implied)
|
||||
> Subject: Security-audit-0026 remediation — flotilla-owned fixes + live GCP/VM hardening
|
||||
> Status: **FINALIZED.**
|
||||
|
||||
> Sanitization note: this transcript is published to the public
|
||||
> `wiggleverse/ohm-session-history`. Because several audit findings were
|
||||
> still **live and unpatched** on production at session end (they belong to
|
||||
> a parallel, not-yet-deployed branch — see "Coordination" below), this
|
||||
> record deliberately references findings by **ID and general category
|
||||
> only** and contains **no exploit sketches or step-by-step reproduction**.
|
||||
> The full-detail audit (`SECURITY-AUDIT-0026-2026-05-28.md`) lives locally
|
||||
> in `~/git/ohm-infra`, which is not a git repository, and was never
|
||||
> published. No secret bytes appear here (§3 invariant 1).
|
||||
|
||||
---
|
||||
|
||||
## Launch prompt
|
||||
|
||||
> full remediation of security report at ~/git/ohm-infra
|
||||
|
||||
The "security report" is `SECURITY-AUDIT-0026-2026-05-28.md` (produced by
|
||||
the parallel audit session 0026): 1 Critical, 1 High, 5 Medium, 9 Low,
|
||||
6 Info findings spanning three surfaces — the **rfc-app** codebase, the
|
||||
**flotilla** CLI (this repo), and the **live GCP/VM** deployment.
|
||||
|
||||
---
|
||||
|
||||
## What this session settled
|
||||
|
||||
Session 0030 took the **flotilla-owned findings** and the **live GCP/VM
|
||||
findings that live in no repo**, applied + verified them, and merged +
|
||||
deployed the flotilla changes. The rfc-app/nginx/systemd findings were
|
||||
left to a parallel in-flight session (see Coordination). Net for OHM:
|
||||
the VM is materially hardened and the operator CLI has three defense-in-
|
||||
depth improvements; the application-layer findings remain pending that
|
||||
other session's release.
|
||||
|
||||
## The "did we leak the audit?" scare (resolved: NO)
|
||||
|
||||
Mid-session the operator flagged that a transcript containing the audit
|
||||
might have been pushed to the public repo before an internet drop. I
|
||||
froze remediation and verified the **entire git history** of
|
||||
`wiggleverse/ohm-session-history` (fresh clone, all branches,
|
||||
`git log -S` for audit-unique strings):
|
||||
|
||||
- Audit session 0026 published **only its 454-byte placeholder** — its
|
||||
full transcript was never pushed (the publish push is atomic; it failed
|
||||
on the internet drop, leaving only the start-gesture placeholder).
|
||||
- **Zero** audit-unique strings appear in any commit, ever.
|
||||
- The audit file itself lives only in local `~/git/ohm-infra` (not a git
|
||||
repo) — never committed anywhere.
|
||||
|
||||
Verdict: nothing leaked. The real containment for the audit's value (an
|
||||
exploit roadmap) is shipping the fixes, which is what the session then
|
||||
continued doing.
|
||||
|
||||
## Coordination — the rfc-app remediation is owned elsewhere
|
||||
|
||||
On inspecting `/Users/benstull/git/rfc-app` I found branch
|
||||
`feature/v0.25.0-security-hardening` already checked out with a large
|
||||
**uncommitted** remediation (a parallel live session, 0027 or 0029).
|
||||
It covers the rfc-app application findings, the nginx server block, and
|
||||
the systemd unit. Editing rfc-app would have clobbered another session's
|
||||
live work, so — with the operator — Session 0030 explicitly scoped to:
|
||||
|
||||
- **flotilla repo** fixes (no overlap), and
|
||||
- **live GCP/VM ops** that exist in no repo.
|
||||
|
||||
The operator chose this division (and chose to perform the live ops this
|
||||
session, and to defer SSH-scoping to a proper IAP rollout).
|
||||
|
||||
## Work performed
|
||||
|
||||
### Flotilla repo (PR #1 — merged)
|
||||
|
||||
Branch `session-0030/flotilla-security-hardening` → **PR #1**, merged to
|
||||
`main` (merge commit `7b32a46`). 161 tests pass.
|
||||
|
||||
- **L1** — the live secret redactor is threaded into `_PhaseRunner` and
|
||||
now scrubs **both** the success and failure phase-`detail` paths before
|
||||
they are persisted to `deploys.phases` / surfaced to the operator
|
||||
(previously only the separate `error_summary` was scrubbed). Test
|
||||
extended to assert no secret survives in any persisted phase detail.
|
||||
(This fix was already present in the working tree at session start;
|
||||
Session 0030 verified, tested, and landed it.)
|
||||
- **I6** — `redact_live` now matches several decodings of the same secret
|
||||
bytes (utf-8/replace, surrogateescape, latin-1) so a non-ASCII secret
|
||||
that surfaced via a different decode path than the needle still
|
||||
redacts. Match only ever redacts more, never less. Residual byte-
|
||||
boundary limitation documented honestly (moot for ASCII/UTF-8 secrets).
|
||||
- **L9** — `ssh.py` no longer leans on `--quiet`'s blanket first-connect
|
||||
host-key accept; it adds `StrictHostKeyChecking=accept-new`, which still
|
||||
connects to genuinely-new hosts non-interactively but **refuses a
|
||||
changed key**. Full first-connect TOFU removal remains the §19.2 IAP
|
||||
item.
|
||||
- **I5** — `overlay set` warns (does not block) when a key name carries an
|
||||
unambiguous secret word, nudging toward `secret bind`/`secret set`.
|
||||
Deliberately does not match generic `*_KEY`/`*_API_KEY`, so public site
|
||||
keys don't train the operator to ignore the warning.
|
||||
|
||||
After merge, a clean idempotent redeploy of the current pin (v0.26.0)
|
||||
exercised the hardened flotilla code end-to-end: **`deploys.id=35`**, all
|
||||
9 phases ok, health verified in 5.0s.
|
||||
|
||||
### Live GCP/VM ops (project `wiggleverse-ohm`, VM `ohm-rfc-app`)
|
||||
|
||||
- **M3** — the SQLite data directory was world-traversable and the DB
|
||||
(plus its WAL/SHM sidecars) world-readable. Tightened the **directory to
|
||||
`750`** (the robust containment — closes world access regardless of
|
||||
per-file mode regression) and the files to **`640`**. Verified to
|
||||
survive both a full VM reboot and a deploy-triggered service restart
|
||||
(sqlite preserves the main DB's mode on its sidecars). Also discovered
|
||||
and **secured** (but did not delete) a set of orphaned `ohm-app.db\r*`
|
||||
files — stale copies left by the historical CRLF path bug; flagged to
|
||||
the operator for deletion after confirmation.
|
||||
- **L5** — deleted the dead `default-allow-rdp` firewall rule (3389 is
|
||||
unused surface on Linux). SSH-from-anywhere left in place by operator
|
||||
decision; the right fix is an IAP rollout (§19.2), not fragile IP
|
||||
scoping.
|
||||
- **L6** — created a dedicated least-privilege runtime service account
|
||||
(`ohm-rfc-app-vm@…`) with logging+monitoring writer only (the app reads
|
||||
its config from `.env` at deploy time, so **no** Secret Manager access
|
||||
is needed on the VM), and swapped the VM off the default compute SA.
|
||||
- **L7** — enabled Shielded-VM **Secure Boot** (boot disk confirmed
|
||||
UEFI-compatible first; vTPM + integrity monitoring were already on).
|
||||
|
||||
L6 + L7 were applied in a single VM stop/start window (~15s of downtime),
|
||||
after confirming no deploy was in flight. All four verified intact after
|
||||
the later deploy.
|
||||
|
||||
### Config verification (audit action item 5)
|
||||
|
||||
Read the live `.env` **variable names** only (no values):
|
||||
- `TURNSTILE_REQUIRED="true"` — confirmed (mitigates the OTC abuse Low).
|
||||
- `GITEA_WEBHOOK_SECRET` — present (Gitea webhook authenticated).
|
||||
- **`WEBHOOK_EMAIL_BOUNCE_SECRET` — absent.** This confirms M5 as a live
|
||||
config gap (the bounce webhook is currently unauthenticated). Handed to
|
||||
the operator with an operator-run secret gesture (never request/echo
|
||||
secret bytes in-conversation — §3 conversation-layer corollary). The
|
||||
operator will bind it and redeploy as a follow-up.
|
||||
|
||||
## Friction / dead-ends (kept honest)
|
||||
|
||||
- The first `chmod 640 …/data/*` failed: having just set the directory to
|
||||
`750`, the non-root SSH login user could no longer list it to expand the
|
||||
glob. Re-ran the file chmod under `sudo sh -c` so root expanded it.
|
||||
- After merging PR #1, `git checkout main && git pull` did **not**
|
||||
fast-forward (local `main` had no upstream tracking), so the working
|
||||
tree briefly reverted to pre-fix code. Recovered with
|
||||
`git fetch && git merge --ff-only origin/main` and set the upstream.
|
||||
No work lost (the fixes were safe in the merge commit).
|
||||
|
||||
## Findings status at session end
|
||||
|
||||
| Owner | Findings | Status |
|
||||
| --- | --- | --- |
|
||||
| **0030 (flotilla)** | L1, I6, L9, I5 | **Done** — merged (PR #1) + deployed |
|
||||
| **0030 (live VM/GCP)** | M3, L5(RDP), L6, L7 | **Done** — applied + verified |
|
||||
| **Operator follow-up** | M5 (config bind), `*.db\r` cleanup, systemd `UMask=0077` | Flagged with gestures |
|
||||
| **Deferred** | L5 (SSH 0.0.0.0/0 → IAP §19.2) | By operator decision |
|
||||
| **Parallel v0.25.0 branch** | C1, H1, M1, M2, M4, L2, L3, L4, L8, I1, I3, I4 | **Pending** — uncommitted, **not yet deployed** (still live on prod) |
|
||||
|
||||
## Cross-references
|
||||
|
||||
- flotilla PR #1 (`wiggleverse/ohm-rfc-app-flotilla`), merge `7b32a46`.
|
||||
- OHM deploy `deploys.id=35`, v0.26.0 (idempotent redeploy exercising the
|
||||
hardened flotilla).
|
||||
- GCP: VM `ohm-rfc-app` / `us-central1-a` / `wiggleverse-ohm`; new SA
|
||||
`ohm-rfc-app-vm@wiggleverse-ohm.iam.gserviceaccount.com`; deleted
|
||||
firewall rule `default-allow-rdp`.
|
||||
- Source audit: `~/git/ohm-infra/SECURITY-AUDIT-0026-2026-05-28.md`
|
||||
(local only — never published).
|
||||
|
||||
---
|
||||
|
||||
## Operating instructions for the next session
|
||||
|
||||
The application-layer security work is the open thread. Concretely:
|
||||
|
||||
1. **Ship v0.25.0.** The `feature/v0.25.0-security-hardening` branch in
|
||||
rfc-app holds the application + nginx + systemd remediation (C1 XSS
|
||||
sanitizer, the auth-verify rate-limit/lockout, the device-trust lookup
|
||||
fix, security headers, cookie hardening, the bounce-webhook
|
||||
`_required` guard, etc.). It is **uncommitted and undeployed**, which
|
||||
means the audit's **Critical (C1)** and other findings are **still live
|
||||
on production**. This is the highest priority: confirm/finish the
|
||||
branch, commit, release as v0.25.0, bump `ohm-rfc/.rfc-app-version`,
|
||||
and deploy via flotilla. Coordinate with whichever session owns that
|
||||
branch (was 0027/0029) before touching it.
|
||||
2. **M5 config** — the operator intends to bind `WEBHOOK_EMAIL_BOUNCE_SECRET`
|
||||
(Secret Manager + `flotilla secret bind` + provider-side config) and
|
||||
redeploy. The code-side `_required` guard rides along in v0.25.0.
|
||||
3. **systemd `UMask=0077`** — add to rfc-app's `deploy/systemd/rfc-app.service`
|
||||
(belt-and-suspenders on top of the `750` data dir).
|
||||
4. **Orphaned `ohm-app.db\r*` files** on the VM — secured to `640`; delete
|
||||
once confirmed orphaned.
|
||||
5. **L5 SSH / IAP (§19.2)** — the deferred item: IAP-only SSH (firewall +
|
||||
tunnel role + flip flotilla's deploy path to `--tunnel-through-iap`),
|
||||
which also retires the L9 first-connect TOFU residue.
|
||||
|
||||
Suggested next-session launch prompt:
|
||||
|
||||
> Ship rfc-app v0.25.0-security-hardening (finish/commit the existing
|
||||
> branch, release, bump the OHM pin, deploy) — this lands the still-live
|
||||
> audit-0026 application findings incl. the Critical XSS. Coordinate with
|
||||
> the session that owns the branch first. Then help the operator bind
|
||||
> WEBHOOK_EMAIL_BOUNCE_SECRET (M5) and add systemd UMask=0077.
|
||||
@@ -1,15 +0,0 @@
|
||||
# Session 0030.0 — Transcript
|
||||
|
||||
> Date: 2026-05-28
|
||||
> Start: 2026-05-28T16-12 (PST implied)
|
||||
> Status: **PLACEHOLDER — claimed at session start; finalized at session end.**
|
||||
>
|
||||
> This file reserves session ID 0030. The driver replaces this body
|
||||
> with the full transcript before publishing, and renames the file to
|
||||
> its final SESSION-0030.0-TRANSCRIPT-2026-05-28T16-12--<end>.md form.
|
||||
|
||||
---
|
||||
|
||||
## Launch prompt
|
||||
|
||||
_(launch prompt not captured at claim time)_
|
||||
Reference in New Issue
Block a user